Business Central

Business Central MCP server in Australia: what SMB teams should test before giving AI agents ERP access

A practical Australian guide to the Business Central MCP server, covering current Microsoft release status, client options, access controls, and what to prove before exposing ERP workflows to AI agents.

Microsoft's current documentation is clear enough to support a practical buying view. The 2025 release wave 2 plan says the Business Central MCP server reached public preview on 31 October 2025. Microsoft's current overview and configuration documentation then explain the operating model: the MCP server is aimed at AI-agent scenarios, works with Business Central online, exposes API pages and queries as tools, supports clients such as Copilot Studio and non-Microsoft MCP clients, and starts with read-only access unless administrators explicitly extend it. For most SMB teams, that is the real decision point. The question is no longer whether Microsoft has an MCP story. It is whether your business is ready to govern one.

What Microsoft has officially released

• Microsoft's release-plan page for connecting AI agents to Business Central through the MCP server lists the capability in public preview from 31 October 2025.
• Microsoft's current MCP overview says the server is designed to let AI tools connect to Business Central data and business logic using the Model Context Protocol, with Business Central resources surfaced through API pages, queries, and actions.
• The same overview says the MCP server currently applies to Business Central online and can be used by Visual Studio Code, Copilot Studio, and other MCP clients including tools such as Claude and ChatGPT.
• Microsoft publishes the default MCP endpoint as https://mcp.businesscentral.dynamics.com.

Why this matters for Australian SMB teams now

• This is one of the first Microsoft-supported paths that makes cross-tool AI access to Business Central concrete enough for shortlist and governance discussions, not just roadmap speculation.
• For lean Australian teams, the attraction is obvious: let an AI assistant search customer, item, vendor, order, or inventory context without forcing staff to jump between screens or ask a developer to wire every prototype manually.
• The risk is just as obvious. ERP data access, workflow actions, and approval boundaries can become blurred quickly when the connection layer is framed as "just an AI integration". Microsoft's own documentation shows that configuration choices here materially change what an agent can see and do.

What the MCP server is good for

• Giving AI agents a standard protocol to discover Business Central tools and data objects instead of building one-off custom integrations for every experiment.
• Supporting scenarios where a user wants conversational access to ERP context, but still needs that interaction grounded in documented APIs, known permissions, and an explicit configuration layer.
• Extending beyond Microsoft-only surfaces. Microsoft's documentation explicitly describes support for Copilot Studio and non-Microsoft MCP clients, which makes the topic relevant even when the business is experimenting with tools outside the wider Dynamics stack.

What it does not solve by itself

• It does not make ERP governance easier automatically. The MCP server exposes tools, but it does not decide whether your data model, permissions, approvals, or exception rules are fit for AI-driven use.
• It does not mean every Business Central environment should expose write-capable actions. Microsoft says read-only access is the default starting point for exposed API pages.
• It does not remove the need to choose the right connection model. Microsoft's documentation distinguishes the Business Central connector from the MCP server, with the MCP path positioned for AI-agent scenarios rather than generic low-code automation.
• It is not an on-prem shortcut. Microsoft's current overview says the MCP server applies to Business Central online.

The control points buyers should understand first

• Read-only starts by default. Microsoft's configuration documentation says the default setup grants read-only permissions to all exposed API pages, which is a sensible baseline for first pilots.
• Write operations are a deliberate opt-in. Microsoft says administrators can allow inserts, modifies, and deletes for actions and API pages in the MCP Server Setup page, which means production-write access should be treated as a governance decision, not a convenience setting.
• Tool sprawl is real. Microsoft documents a dynamic tool mode and a discovery step for additional objects, and for Copilot Studio specifically notes a maximum of 70 tools per agent. If a team exposes too much too early, usability and control both get worse.
• Object coverage has limits. Microsoft documents that API pages and queries are supported while ListPart and CardPart pages are not, which matters when teams assume every useful screen or process can be surfaced immediately.

Copilot Studio versus non-Microsoft MCP clients

• Microsoft's current Copilot Studio documentation recommends using the onboarding wizard from Business Central to add the MCP server and says the MCP server uses the Streamable transport type.
• Microsoft also states that Copilot Studio no longer supports the older Server-Sent Events transport after August 2025. That matters when partners or internal teams are working from older MCP examples.
• For non-Microsoft clients, Microsoft documents a different setup path. Because Microsoft Entra ID does not currently support Dynamic Client Registration, users must create a custom app registration and assign delegated permissions including user_impersonation and Financials.ReadWrite.All.
• That setup detail is commercially important. The moment a business wants Claude, ChatGPT, or another non-Microsoft client to reach Business Central through MCP, identity design and security review become first-class work items rather than background plumbing.

What to test before approving any pilot

• Start with one read-only scenario. Good examples include checking customer balances, surfacing item availability, summarising late orders, or retrieving vendor details for a finance review.
• Prove permission boundaries with real user roles. Do not test only with admin accounts. Microsoft's model assumes access stays tied to Business Central permissions, so least-privilege design should be visible in the pilot evidence.
• Limit the tool set aggressively. Use only the API pages, queries, and actions needed for the scenario, then check whether the agent still produces useful outputs without broad object exposure.
• Test bad prompts and ambiguous prompts, not just clean demos. The team should see what happens when a user asks for data across entities, requests restricted information, or implies an action that should stay manual.
• Decide in advance what would justify write access, if anything. Many SMB pilots will learn enough from read-only retrieval and summarisation without giving an AI agent permission to change ERP records.
• Verify commercial ownership. If the design involves Copilot Studio, non-Microsoft clients, or custom identity work, document who owns licensing, support, and security response before expanding scope.

Where SMB teams usually get this wrong

• They frame MCP as a technical connector decision when it is really a process-control decision.
• They move too quickly from "the agent can read it" to "the agent can update it" without a business case strong enough to justify the extra risk.
• They let one enthusiastic AI proof of concept expose too many tools and objects, which makes output quality worse and governance harder.
• They overlook the setup difference between Microsoft and non-Microsoft clients and discover late that identity, permissions, or support assumptions were never properly agreed.

The practical buyer conclusion

• The Business Central MCP server is now mature enough to be a real 2026 evaluation topic for Australian SMB and mid-market teams exploring AI around ERP.
• A sensible first move is one narrow, read-only pilot on Business Central online, using a clearly bounded tool set and explicit role-based access checks.
• The wrong move is to treat MCP as a shortcut to autonomous ERP automation. The better move is to treat it as a governed integration layer that can prove value safely before any broader rollout or write-capable workflow is considered.

FAQ

• Is the Business Central MCP server generally available? Microsoft's current release-plan page lists the feature in public preview from 31 October 2025, so buyers should still treat it as a pilot-first capability rather than assume full production maturity everywhere.
• Does it work with ChatGPT or Claude? Microsoft's current MCP overview says the server supports non-Microsoft MCP clients, and the non-Microsoft client setup documentation explains the custom app-registration path required for those tools.
• Does it work with Business Central on-premises? No. Microsoft's current MCP overview says the server applies to Business Central online.
• Should the first pilot allow writes back into ERP? Usually no. Microsoft's default model starts read-only, and that is the safer way to validate value before introducing insert, modify, or delete permissions.

Sources used

• Microsoft Learn release-plan page: Connect AI agents to Business Central through MCP server.
• Microsoft Learn article: Use the Business Central MCP server in AI applications.
• Microsoft Learn article: Configure the Business Central MCP Server.
• Microsoft Learn article: Add the Business Central MCP server to Copilot Studio agents.
• Microsoft Learn article: Connect to Business Central with non-Microsoft MCP clients.